Solved Cable Modem->VLAN Tagged Switch->MoCA Adapter->MoCA Adapter->VLAN Tagged Switch->AX86U Router

[GHammer]

@Crimliar @ColinTaylor

Ok, I removed VLAN 1 from all ports related to the trunk and modem/router. That of course had the side effect of removing the ability to manage far switch.

It also had no effect on the ability to get the modem to give an IP to the router.

So, I shall return all this equipment, grab a spool of outdoor CAT 6 and get pulling. The house in question is a rental, so I can only poke so many holes/do so much. That's why I wanted to have this work. All I can think is Arris cable modems do not like anything between them and a router.

Fiber is so much easier for things like this.

Thanks for the try.

 

[drinkingbird]

@Crimliar @ColinTaylor

Ok, I removed VLAN 1 from all ports related to the trunk and modem/router. That of course had the side effect of removing the ability to manage far switch.

It also had no effect on the ability to get the modem to give an IP to the router.

So, I shall return all this equipment, grab a spool of outdoor CAT 6 and get pulling. The house in question is a rental, so I can only poke so many holes/do so much. That's why I wanted to have this work. All I can think is Arris cable modems do not like anything between them and a router.

Fiber is so much easier for things like this.

Thanks for the try.

Try it in phases

For this exercise, use VLAN 10 for WAN and 20 for LAN. Disable any dual WAN or VLAN stuff you've done on the router. Ideally reset everything (router and switches) to factory defaults if you can. You're going to feed untagged frames to the modem and router, neither needs to be VLAN aware.

First, to ensure the cable modem is not choking on the fact that it sees one MAC directly connected at L2 and a different L3 MAC requesting DHCP, just connect one of the switches in the path between modem LAN and router WAN (with everything at factory defaults). Boot up the modem (or reboot it if already online to make sure it is seeing the correct MAC). If the router gets an IP, then no issues there. If it can't, then definitely sounds like the modem wants to see the same MAC at L2 and L3. Technically you could try spoofing the MAC of the switch port that is connected to the modem onto the router WAN, it might work but it would probably be a bit buggy if it did, not a path I would take. You need a much higher end switch/bridge to enable transparency and pass through the router's MAC, that's not something you're going to want to invest in, and you're pretty much stuck with running your ethernet cable. However cable modems I've seen only seem to care about the MAC requesting a DHCP IP, so hopefully that is not the issue here.

If above is working, then try
Switch1 port1 facing the modem - UNtagged VLAN 10 only
Switch1 port2 facing the first MOCA adapter - UNtagged vlan 10 only
Switch2 port1 facing the second moca adapter - UNtagged vlan 10 only
Switch2 port2 facing the router WAN port - UNtagged vlan 10 only
Reboot cable modem again just to be safe (even though nothing should have changed from its perspective)

Obviously, that should definitely work. If not, there is something else wrong with cabling or possibly something you're missing in the switch config.

If it works, then change just this
Switch1 port2 facing the first MOCA adapter - change vlan 10 to tagged
Switch2 port1 facing the second moca adapter - change vlan 10 to tagged
Rebooting cable modem should not be necessary as it should still be seeing the correct MAC, but they can be finnicky, worth doing anyway.
Does it still work? If yes, you're on the right track. If no, it appears your moca adapters are not liking 802.1Q frames. You can test this by removing the moca adapters on your test bench and just using an ethernet cable. If it still doesn't work, there is something else in the switches that needs to be configured to support VLAN tagging correctly. Some switches will require you to have VLAN 1 untagged on both ports above since that is the native VLAN. Usually it is just there by default and doesn't require you to do anything, but if the above isn't working, may need to add it (untagged if you get the option) to both ports. If you get it working over ethernet but not MOCA, then you need to look into other MOCA adapters that won't choke on the 802.1Q frames.

Assuming you get it working over MOCA, now try this
Switch1 port2 facing the first MOCA adapter - add tagged vlan 20 (leaving 10 tagged also)
Switch2 port1 facing the second moca adapter - add tagged vlan 20 (leaving 10 tagged also)
Switch2 port3 (new port) facing router LAN port - UNtagged vlan 20 only
Any ports on switch1 or switch2 that you want in the LAN - set to UNtagged vlan 20 only
Does it still work and do you now have LAN connectivity also (other than switch management which you'll have to do through one of the VLAN 1 ports at this point probably)?

If yes, now you have a few options:
If your switches let you change the management VLAN, change them both to 20 and you should be able to manage them from any LAN port on the router or vlan20 port on either switch.
If not, and you don't need to manage the switches that often, you can just ensure you leave a port in VLAN 1 and connect a laptop/set a static IP when you need to manage them.

If your switches only support vlan 1 for management, and you DO need easier switch management, you'll need to try the below. Most home switches I've seen (even small business oriented switches) will not allow you to tag VLAN 1, which is correct since it is technically never supposed to be tagged. There are workarounds on enterprise switches, but in this case, leaving 1 untagged is not an issue in the home environment. Try the below

Change just these
Switch1 port2 facing the first MOCA adapter - tagged vlan 10 and UNtagged vlan1 (remove 20, no longer needed, or keep it for future use, doesn't matter)
Switch2 port1 facing the second moca adapter - tagged vlan 10 and UNtagged vlan 1 (same note about vlan 20)
Switch2 port3 facing the router LAN port - UNtagged vlan 1 only instead of 20 (definitely remove 20 here, you don't want it at all)
Then on either switch, any ports you want on the LAN should be UNtagged vlan 1 only (instead of 20)

Now if all this is working on your test bench, try moving it all into reality. If it doesn't work there, you may be having issues with MOCA in your wiring system, interference from splitters or other coax devices potentially. That's a whole separate troubleshooting thread.

 

[ColinTaylor]

First, to ensure the cable modem is not choking on the fact that it sees one MAC directly connected at L2 and a different L3 MAC requesting DHCP, just connect one of the switches in the path between modem LAN and router WAN (with everything at factory defaults).

Slightly confused here. Why would a switch, smart or not, be changing the MAC address? Surely that would break lots of things on a LAN, including DHCP. Is this something that "cheap" switches do? I've never come across such a thing but then most of my experience is with Cisco enterprise kit.

 

[drinkingbird]

Slightly confused here. Why would a switch, smart or not, be changing the MAC address? Surely that would break lots of things on a LAN, including DHCP. Is this something that "cheap" switches do? I've never come across such a thing but then most of my experience is with Cisco enterprise kit.

It isn't changing the MAC, it is just another MAC on the segment.

Every switch port (every ethernet port for that matter) has a MAC address, regardless of how cheap or expensive it is. It is possible that a cable modem's configuration could cause it to not assign a DHCP IP to a MAC that is different from the locally connected one (it will see that it is physically connected at Layer 2 to one MAC, but the DHCP request is coming from another). I've never tried inserting a switch between a cable modem and router (and every ISP is free to configure their restrictions differently) so the only way to know is just try it. From what I've seen, the modem/ISP usually only cares that you get one and only one DHCP lease, so don't think it will care about the switch being there, but never know.

Most carrier and some enterprise switches can often be configured as transparent bridges where they will not report their MAC to the directly connected device, instead reporting the MAC of the upstream device. But a typical home switch won't have that feature (unless things have come a long way, haven't used a "smart" home switch in a long time). Even enterprise environments usually won't use this feature except in specific rare scenarios. Enterprise L2 firewalls often do it by default so you won't know they're there and to reduce the attack footprint (can't spoof a MAC if you can't see it).

 

[ColinTaylor]

It is possible that a cable modem's configuration could cause it to not assign a DHCP IP to a MAC that is different from the locally connected one (it will see that it is physically connected at Layer 2 to one MAC, but the DHCP request is coming from another).

Hmm, just thinking aloud here... I can't see how the modem could be aware that the Ethernet frame it received was via a switch rather than a directly connected host. Even though the switch ports have their own MAC addresses the switch is operating as a transparent bridge. The switch port runs in promiscuous mode so that it accepts L2 packets destined for other devices. Packets from the modem have the destination host's MAC address in the Ethernet frame, not the switch port's. Packets returning to the modem from the host have the original source and destination MAC addresses in the Ethernet frame. It's not as if the switch is replacing the source MAC address with its own MAC address.

But I suppose anything is possible. So as you say, it's worth checking it.

 

[GHammer]

First, to ensure the cable modem is not choking on the fact that it sees one MAC directly connected at L2 and a different L3 MAC requesting DHCP, just connect one of the switches in the path between modem LAN and router WAN (with everything at factory defaults). Boot up the modem (or reboot it if already online to make sure it is seeing the correct MAC).

Thanks for the very well reasoned and complete guide!
I reset things to factory, setup only the mentioned VLANs. It fails at this point.
I haven't a clue as to why, I'd need to get a way to capture the traffic at the modem port as I bring each device up.

I already had removed all equipment save a single switch, the router, and modem. Tried many different VLAN configurations, etc.
With the exception of using another router to be the 'source' DHCP and this router just connecting as to any other ISP, no other configuration is able to get a DHCP address. At that, though the VLAN is untagged, for whatever reason no DHCP could be had over the WAN port. I had to have the IPTV/Dual WAN configured. Then all worked normally and quickly. Might be the particular model switch I am using, Netgear GS308T.

I have zero faith in the ability to connect this brand modem using this ISP to a router by any means other than a direct connection at this point. It would have been much easier this way, but I made a commitment to a friend to get their internet connection in a usable state this week and I'm out of time to purchase different equipment unless someone has first hand experience in doing exactly this. Others are able to do a similar thing with slightly different equipment, but that is little comfort to this situation/configuration. So, cabled it will be with as little drilling as possible. No idea why their landlord decided the far end of the basement was a stellar location for a cable modem...


@drinkingbird

Your guide/tutorial should be separated and made a sticky somewhere on the forum. It is truly a master course in how/why to configure and troubleshoot this type of issue.

 

[GHammer]

This did work when connected with no VLAN involved.
Switch 1 port 1-> cable modem LAN
Switch 1 port 8-> router WAN
IP pulled from cable modem no problem.

Add untagged VLAN 10 remove VLAN 1 from those ports, power cycle the modem, power cycle the router, ISP Failure.

 

[drinkingbird]

Hmm, just thinking aloud here... I can't see how the modem could be aware that the Ethernet frame it received was via a switch rather than a directly connected host. Even though the switch ports have their own MAC addresses the switch is operating as a transparent bridge. The switch port runs in promiscuous mode so that it accepts L2 packets destined for other devices. Packets from the modem have the destination host's MAC address in the Ethernet frame, not the switch port's. Packets returning to the modem from the host have the original source and destination MAC addresses in the Ethernet frame. It's not as if the switch is replacing the source MAC address with its own MAC address.

But I suppose anything is possible. So as you say, it's worth checking it.

Over the years "transparent" has changed meaning several times (and it also gets confused with VTP transparent mode which is totally different). Personally I consider a transparent bridge to be one that is not showing its own MAC address, rather forwarding the mac address of whatever is connected upstream. There are a lot of reasons to do that in the carrier or security space, but generally two layer 2 devices connected together are able to see each others' port MAC, in addition to the MACs learned via that port. That MAC gets used for several functions on smarter switches, not really used on dumb ones, but I suspect if you were to be able to dump the MAC table on a dumb switch, you'd see the physical port MAC of the next hop switch in there.

The cable modem is just a Layer 2 bridge, it is aware of the MAC of the directly connected device, and will learn the MAC of any additional devices on that same L2 segment. Even a router is capable of seeing the mac of the directly connected switch, it typically just doesn't care about it.

I suspect based on what the OP has just written that the cable modem is enforcing its "one device" rule based on the physically connected MAC and not on the one sending the DHCP request. Just a guess though.

 

[drinkingbird]

This did work when connected with no VLAN involved.
Switch 1 port 1-> cable modem LAN
Switch 1 port 8-> router WAN
IP pulled from cable modem no problem.

Add untagged VLAN 10 remove VLAN 1 from those ports, power cycle the modem, power cycle the router, ISP Failure.

That is very odd, you need to look through the switch configs, maybe you need to define VLAN 10 somewhere in order for it to become active?

EDIT looks like that is in fact the case - are you following this guide - https://kb.netgear.com/31026/How-to-configure-a-VLAN-on-a-NETGEAR-managed-switch ? Looks like you need to define the VLAN, assign it to ports as either tagged or untagged, then go set it as the PVID of any access/untagged ports in that VLAN as well. I also see a conversation on google about LAG potentially interfering and having to clear out settings for that but it isn't clear if that was only when using a LAG group.

So basically go to the PVID screen and any port that is UNtagged VLAN, set the PVID to the same VLAN. That is the only way it will work. PVID just tells the switch what VLAN ID to assign to frames entering that port - enterprise switches do this automatically on access ports, not sure why Netgear splits it out.
Once you get to the point of tagging VLANs, those ports (only the ones with tagging) should just have PVID 1/default. So if you get it all working, you'll have some ports with PVID 1, some with 10, and some with 20.

Having untagged VLAN 10 and untagged VLAN 1 should be no different. Maybe take one step even further back and just connect two laptops with static IPs and once you're able to ping between them, you know you have the settings right. Or connect the laptop and router LAN to the same switch and when configured properly, your laptop should get an IP from the router and be able to access it.

 

[drinkingbird]

Your guide/tutorial should be separated and made a sticky somewhere on the forum. It is truly a master course in how/why to configure and troubleshoot this type of issue.

Appreciate the kind words but it probably isn't a common enough scenario for many to really care (though I have seen others doing it for much the same reasons, actually often not using managed switches, just using an old asus router etc as the first switch and doing robocfg vlan commands).

A lot of times the enterprise stuff I work with is different (or more flexible) than home stuff but the concepts are the same, same standards etc. There are two potential "wrenches in the works" of your scenario, the MOCA adapters possibly not supporting 802.1q formatted ethernet frames (somewhat unlikely, they should be just blindly converting) and whatever the ISP is doing on the modem to prevent you from having more than 1 device.

Sounds like you've gotten it working with a single switch in the path and no VLANs, that would imply that the ISP does not care that there is a switch in the path, as long as only one device is asking for an IP, which is good. I think you just need to focus on the VLAN config on that netgear, I bet there is just one thing that got missed and it will start working when you fix that. For whatever reason it looks like netgear wants you to add the port to a VLAN then also go to a separate place and set that VLAN as the PVID on the port too (after creating the VLAN of course, but I'm assuming you did that or it probably wouldn't even show up as an option to assign to a port).

As mentioned, also make sure you do not have LAG enabled and there are no VLANs assigned to any LAG ports anywhere, etc. I think that thread I found was probably someone who had mistakenly enabled LAG but worth double checking.

 

[GHammer]

Sounds like you've gotten it working with a single switch in the path and no VLANs, that would imply that the ISP does not care that there is a switch in the path, as long as only one device is asking for an IP, which is good. I think you just need to focus on the VLAN config on that netgear, I bet there is just one thing that got missed and it will start working when you fix that. For whatever reason it looks like netgear wants you to add the port to a VLAN then also go to a separate place and set that VLAN as the PVID on the port too

Three cheers and many beers!
That was exactly the missing info and config.

In the following, modem switch refers to the Netgear managed switch being configured, not a switch on the modem.

I wiped the modem switch, set VLAN 10 on ports 1 and 8, set the PVID on ports 1 and 8 to 10.
Took a cable from modem switch port 2 to the switch that feeds my house, just to get LAN on the modem switch.
Plugged a PC into modem switch port 3
All is fine at this point, I can manage the modem switch and browse the internet from the connected PC.
I removed the cable from the router WAN port to the cable modem LAN port and plugged it into modem switch port 1.
Took a cable from modem switch port 8 to the cable modem LAN port.
Router went from cable disconnected to connected. Same IP as nothing had changed for the cable modem.

LAN and internet work just as they did.

Tomorrow, instead of heading out to get CAT 6 and tools, I will configure the entire chain, then Tuesday head for my friend's house to install.

@drinkingbird

I can't express my thanks!
You took the time to walk this through, dug up info that I should have had, but didn't. You sir are an excellent teacher and troubleshooter.

 

[GHammer]

the MOCA adapters possibly not supporting 802.1q formatted ethernet frames

I'm assured by GoCoax and users who do so that the MoCA devices will just pass what they receive. For me, it was the inability to get the router and modem to speak.

 

[drinkingbird]

Three cheers and many beers!
That was exactly the missing info and config.

In the following, modem switch refers to the Netgear managed switch being configured, not a switch on the modem.

I wiped the modem switch, set VLAN 10 on ports 1 and 8, set the PVID on ports 1 and 8 to 10.
Took a cable from modem switch port 2 to the switch that feeds my house, just to get LAN on the modem switch.
Plugged a PC into modem switch port 3
All is fine at this point, I can manage the modem switch and browse the internet from the connected PC.
I took the cable from the router to the cable modem and plugged it into modem switch port 1.
Took a cable from modem switch port 8 to the cable modem.
Router went from cable disconnected to connected. Same IP as nothing had changed for the cable modem.

LAN and internet work just as they did.

Tomorrow, instead of heading out to get CAT 6 and tools, I will configure the entire chain, then Tuesday head for my friend's house to install.

@drinkingbird

I can't express my thanks!
You took the time to walk this through, dug up info that I should have had, but didn't. You sir are an excellent teacher and troubleshooter.

Excellent, always nice when things come together. I would test with the MOCA adapters and VLAN trunk/tagging configured (if you have them and the 2nd switch there with you) just to make sure it is all still good, but at this point I think you're in good shape.

Still find it odd that Netgear has you separately configure the input VLAN ID and output VLAN ID on two separate screens. Can't think of any reason you'd ever want them to not match, certainly not in the home setting.

I think you'll want to end up with something like this (adjust ports however you want to arrange them):
Modem Switch:
Port 1 - vlan 10, untagged, pvid 10 - connect to modem
Ports 2-7 - vlan 1, untagged, pvid 1 - available LAN ports
port 8 - vlan 10 tagged, vlan 1 untagged, pvid 1 - connect to MOCA adapter going to router switch

Router Switch:
Basically same config as above except swap the words "modem" and "router" and also connect one of the LAN ports (2-7) to one of the LAN ports on the router. Maybe swap ports 1 and 8 if that makes more sense but just a matter of preference.

Of course your next challenge may be throughput over the MOCA portion of the link, in which case you might need to rearrange/reduce splitters etc but one thing at a time. Hopefully that portion just works (MOCA has gotten pretty good, less issues than in years past). You may be limited by the throughput of whatever adapters you got but should be able to get at least 80M over them, higher if you went with newer MOCA versions.

If you think this is confusing, just be happy that consumer devices don't support Q-in-Q trunking (vlans within vlans).

 

[drinkingbird]

I'm assured by GoCoax and users who do so that the MoCA devices will just pass what they receive. For me, it was the inability to get the router and modem to speak.

That's good, no reason they shouldn't pass it but not an expert on the MOCA adapters. VLAN tagged ethernet frames are slightly larger than regular ones, that's the only reason it crossed my mind.

Several ISPs use VLANs over MOCA-WAN, and MOCA-WAN is just MOCA-LAN on different channels/frequencies, so yeah can't see why it wouldn't handle it fine.

Ha, you're using MOCA-LAN protocol to send your WAN. Do you also drink Coke from a Pepsi glass

 

[GHammer]

Of course your next challenge may be throughput over the MOCA portion of the link

I have the GoCoax for the new install. I use them here and get 1Gb connection between them. Very nice, if you have clean coax.

 

[DeDragonSlayer]

I think you'll want to end up with something like this (adjust ports however you want to arrange them):
Modem Switch:
Port 1 - vlan 10, untagged, pvid 10 - connect to modem
Ports 2-7 - vlan 1, untagged, pvid 1 - available LAN ports
port 8 - vlan 10 tagged, vlan 1 untagged, pvid 1 - connect to MOCA adapter going to router switch

This is actually very similar to the configuration I am currently using.
I have 2 separate LTE modems in the attic, along with a Synology NAS and an AiMesh node.
Downstairs I have the RT-AX88U as main router, along with my PC and rest of network stuff.

The attic and downstairs are connected only by a single coax with MOCA adapters on each end.
Because I have two modems and Dual WAN enabled on AX88U, the coax has to carry three VLANs in my case.

I haven't had any network issues due to this configuration, and all switches and modems are manageable from my downstairs PC.

 

[GHammer]

I think you'll want to end up with something like this (adjust ports however you want to arrange them):
Modem Switch:
Port 1 - vlan 10, untagged, pvid 10 - connect to modem
Ports 2-7 - vlan 1, untagged, pvid 1 - available LAN ports
port 8 - vlan 10 tagged, vlan 1 untagged, pvid 1 - connect to MOCA adapter going to router switch

Router Switch:
Basically same config as above except swap the words "modem" and "router" and also connect one of the LAN ports (2-7) to one of the LAN ports on the router. Maybe swap ports 1 and 8 if that makes more sense but just a matter of preference.

@drinkingbird

Sorry for the delay. I had an equipment failure and just got a replacement.

Ok, I tested with both switches configured one at a time as a single switch, no trunk, no tagging of VLAN 10. Both switches pass the modem to the router and we achieve a connection.
Configure both as outlined, back to the "ISP DHCP doesn't work" error.

I'm attaching screenshots of both switches PVID config page as that shows all the VLAN info in one spot.

 

[GHammer]

@drinkingbird

It's working.
I decided to add a VLAN for LAN tagged it on the trunk. So 10 and 20 are tagged on port 7 each switch. Port 8 is untagged only 10. Ports 2-6 are untagged 20.

Then, all comes up and works
VLAN 1 will not carry across a trunk on this switch it seems.
Or it may, just not in any config I tried

 

[drinkingbird]

@drinkingbird

It's working.
I decided to add a VLAN for LAN tagged it on the trunk. So 10 and 20 are tagged on port 7 each switch. Port 8 is untagged only 10. Ports 2-6 are untagged 20.

Then, all comes up and works
VLAN 1 will not carry across a trunk on this switch it seems.
Or it may, just not in any config I tried

Were you leaving VLAN 1 untagged on the trunk? VLAN 1 can't be tagged per standards, so the trunk port (7) on both ends should have VLAN 1 untagged, VLAN 10 tagged, and PVID 1. Of course, there is always the possibility that Netgear wants it tagged going against the standard, could try that also (both 1 and 10 tagged on the trunk ports, untagged on all others). That shouldn't work (it shouldn't even let you tag 1) but who knows with some of these switches. They also shouldn't let you set the PVID to be different than the outgoing VID but they do.

Technically what you have set up now is cleaner. The only catch is you can't manage the switches without leaving a port in VLAN 1 and plugging into that/configuring a static IP when you need to reach them. Of course, probably not a lot of need to reach them frequently now that they're working.

Only way around that I can think of is if you were to plug a second LAN port from the Asus into a switch port in VLAN 1, and give the switches IPs in the LAN DHCP subnet. However, depending on how the Asus and Netgear spanning tree work, it might cause (or falsely detect) a bridge loop. It shouldn't, since they are in separate VLANs on the switch. That would only get you to the switch connected to the router, then you'd have to get VLAN 1 working across the trunk as well, which kind of puts you right back where you started, and at that point makes more sense to figure out how to get 1 working as your LAN instead.

 

[drinkingbird]

Only way around that I can think of is if you were to plug a second LAN port from the Asus into a switch port in VLAN 1, and give the switches IPs in the LAN DHCP subnet. However, depending on how the Asus and Netgear spanning tree work, it might cause (or falsely detect) a bridge loop. It shouldn't, since they are in separate VLANs on the switch. That would only get you to the switch connected to the router, then you'd have to get VLAN 1 working across the trunk as well, which kind of puts you right back where you started, and at that point makes more sense to figure out how to get 1 working as your LAN instead.

@GHammer actually disregard what I said above. I'm assuming you've left port 1 on both switches in VLAN 1. In theory, if you connect a short loop cable between port 1 and 2 on each switch, and give the switches management IPs in your LAN subnet, that should make them reachable from anywhere on the LAN without having to send VLAN 1 across the trunk (since VLAN 20 now has access to VLAN 1). This works fine on enterprise switches with VLAN aware spanning tree (PVST, PVST+), and it looks like Netgear supports MSTP which is similar (though I have no experience with it). You might have to change the STP mode in the switches from RSTP to MSTP to prevent it from blocking this loop, not sure though.

Granted my brain is fried for the day and I haven't drawn this out on paper, but I can't see where any bridge loops would be created. Worst case, if the switches stop passing traffic and the activity lights are going crazy, you've created a loop, just unplug the loop cable.


EDIT ok - helps to actually look. I could have sworn when I looked before it said your model switch only supports management VLAN 1. However the manual I'm looking at now for GS308T/GS310TP says you can change the management VLAN. Just change both switches to be managed in VLAN 20, and you're golden. VLAN 1 is not used at all at that point. You still need to give them IPs in the LAN subnet or set them to use DHCP (static probably makes more sense). If it does in fact allow you to change it to VLAN 20 then ignore everything above, that is by far the better solution. Now you can set port 1 on both switches to be VLAN 20 also and you gain a couple extra ports.